diff options
| author | Tianjia Zhang <tianjia.zhang@linux.alibaba.com> | 2021-07-15 17:17:24 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-09-22 11:43:04 +0200 |
| commit | 687a0bffec83a1d4013eeb4be5b34d87fe4f9baf (patch) | |
| tree | 15d2ea82e3d926eeb6b7570a0e658d745cab8bc0 /security | |
| parent | 2c98fa72f329a44c15983ffbdf3accddf0c1c159 (diff) | |
| download | linux-687a0bffec83a1d4013eeb4be5b34d87fe4f9baf.tar.gz linux-687a0bffec83a1d4013eeb4be5b34d87fe4f9baf.tar.bz2 linux-687a0bffec83a1d4013eeb4be5b34d87fe4f9baf.zip | |
Smack: Fix wrong semantics in smk_access_entry()
[ Upstream commit 6d14f5c7028eea70760df284057fe198ce7778dd ]
In the smk_access_entry() function, if no matching rule is found
in the rust_list, a negative error code will be used to perform bit
operations with the MAY_ enumeration value. This is semantically
wrong. This patch fixes this issue.
Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'security')
| -rw-r--r-- | security/smack/smack_access.c | 17 |
1 files changed, 8 insertions, 9 deletions
diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c index e5d5c7fb2dac..b25cc69ef7ba 100644 --- a/security/smack/smack_access.c +++ b/security/smack/smack_access.c @@ -90,23 +90,22 @@ int log_policy = SMACK_AUDIT_DENIED; int smk_access_entry(char *subject_label, char *object_label, struct list_head *rule_list) { - int may = -ENOENT; struct smack_rule *srp; list_for_each_entry_rcu(srp, rule_list, list) { if (srp->smk_object->smk_known == object_label && srp->smk_subject->smk_known == subject_label) { - may = srp->smk_access; - break; + int may = srp->smk_access; + /* + * MAY_WRITE implies MAY_LOCK. + */ + if ((may & MAY_WRITE) == MAY_WRITE) + may |= MAY_LOCK; + return may; } } - /* - * MAY_WRITE implies MAY_LOCK. - */ - if ((may & MAY_WRITE) == MAY_WRITE) - may |= MAY_LOCK; - return may; + return -ENOENT; } /** |